New Wave Of Spam From ds4ns1ns2.cn (89.28.14.35). Blogger Beware!

Photo from Brett's Site http://brettduncan.wordpress.com/2007/08/17/blog-spam-crock-or-compliment/

Spam is a ever hated beast in this world. It is the prostitution of all that is good on the internet. Worse than a cockroach and sticks more than a garbage dump. Just like anything evil in this world, the more you try to kill it the stronger it rebounds. Fear not though, there are way to get around many of our spam problems.

For e-mail, there are solutions like Gmail with built in social-spam-detection, as I call it, Bogofilter, Spam Assassin, Razor and many more for e-mail. For Word Press blogs we have the almighty collaborative spam detection plugin: Akismet.

Blog’s have been riddled with spam from all sorts since the beginning and I highly doubt that we will see an end to it anytime soon, but we can fight it. Akisment currently stands at the #1 WordPress commend spam solution. It is free for personal use. Free as in beer, and just as tasty. If you run a WP blog, you will almost certainly need Akismet unless you want a spam LolZ cat “inside youz Blog, spammin joo commentz”.Though, lately things have been changing it seems.

Spammers aren’t dumb, they spam for a reason. It profits them in one way or another, thus they keep doing it. Or they simply way to disrupt systems, annoy the crap out of people or get revenge … who knows. So, why I am I already telling you something you already know? Because ‘they’ are changing tactics, and they are doing it fast.

A little while ago I recieved a comment from a “Andrew Boldman” who seemed like a nice person. Let me a rather nice comment saying “I really liked this post. Can I copy it to my site? Thank you in advance.” Honestly, I was estatic that someone commented and wanted to use some of my content. I threw a ceromony, threw a party and almost made a press release. And then another comment soon after from “Kelly Brown” saying how much she “really like[d] [my] post”. By the Gods! I have commenters. I was on my way to success … or so I thought.

Soon I received another comment, and then another. And I began to ask … huh, why all of a sudden? As I looked over the comments I noticed something strange, all of the e-mail addressed ended with “ds4ns1ns2.cn”. Well that’s a little bit strange, maybe a firewalled area where they all have to send out using one service? Seems just a teebit odd. I checked the IP … all from the same IP: 89.28.14.35.

And that’s when I knew it … it was spam. All these nice comments and spam. So, where is this comming from and why? Several ideas flow around but one rather good theory goes like this, as stated well by Mark Brain on the Warrior Forum. He said:

It’s possible that they are testing sites which will accept spam or those without moderators to control the spam. After that they will have a list of the sites that are “spam havens” then begin posting the actual links.

A simple google search for “ds4ns1ns2.cn” reveals a plethora of spam details about this. The first page results are loaded with spam complains and details from these people:

Spam spam spam. Checking the first website will give you a list of e-mails which originate from that one IP, and mind you it is no short list.

So what does this kind of spam mean to us? It means we should be locking down our blogs. See, this spam is basically a test to see which blogs they can use to spam in the future. If they find a blog which allows unmoderated comments they will quickly jump on it to and use it as a spam source. Since many bloggers do not secure their blogs enough, this gives the spammers an easy way drive automated traffic to their other spam services. Who knows, maybe these open blogs can even be hijacked to be used for even more spamming.

Also from the Warrior forum:

There’s also a setting many of us use on WP blogs to moderate the FIRST comment from a particular user. Once the first comment is approved, they can post without moderation.

So if you leave an innocuous comment on a recent post, and it’s approved, you can comment-spam the hell out of the older posts without anyone noticing. Who reads the comments on last year’s blog posts?

He’s right. In blogs like that, no one is going to care but the spammers. And they are free loading off of your hard work and might even be damaging it. Heck, there is even a WordPress Support topic about this issue here.

My theory on all of this is that this is a form a social engineering. The spammers are using ‘nice’ comments which entice bloggers to allow them. Now, not only do they find out how linient bloggers are but also which kind of messages work and don’t work on people. This will allow them to craft more and more “natural” spam that might just get through our systems soon enough. Ontop of all of this, once you approve a comment from them most WP blogs are set to allow any comments from that same person / IP again freely.

Once they have one comment approved they might just have free comment access on your blog. The other thing they find out is if your blog is ‘open’. Meaning if you don’t moderate your comments at all, you are SOL and you’r blog will probably be a ‘spam haven’ very soon.

All this data they collect, in addition to any people’s e-mail whom might have replied directly to the spammes plus God knows what else, can easily be mined for all sorts of useful tibits. By ‘mined’ I mean data mined, extracting information/knowledge from given data. Remeber tha AOL info leak a while back and how people drank up all of it? They extracted a lot of data from that, much of which was NOT apparent at first. Same thing could happen here.

So, how do we help stop spam like this:

1. Get Akismet
2. USE Akisment (really, it works and it’s free … as in beer)
3. Force users to enter name and e-mail before commenting
4. Enable “Comment Moderation” for all comments.
5. If a comment looks ‘ok’ but you’re not sure search for it on the internet to see if anything comes up.
6. You can be really paranoid and delete any ‘short’ comments that come your way.
7. Do NOT give the spammers any satisfaction by replying to them via e-mail or comments.
8. Inform any blogger you know who’s blog isn’t secure.

If anyone has any extra comments on how to stop and fight these spammers let us know in the comments. To arms!

What are your thoughts about this? Let me know in the comments below!

  

Tweet

Share

Save

Incoming search terms:

• hello craft cn

Related posts:

1. Filter Spam with Quick E-mail (and Gmail) Hack
2. Blogging by e-mail in WordPress
3. Tea Drinkers Beware: Hot Tea Can Kill (eventually)

Tagged as: 89.28.14.35, akismet, ds4ns1ns2.cn, spam, WordPress